Ensure system accounts are secured

점검 방법

감사 방식: 셸 명령

min=$(awk '/^[[:space:]]*UID_MIN/{print $2}' /etc/login.defs); min=${min:-1000}; shells=$(awk -F/ '/^\// && $NF != "nologin"' /etc/shells); bad=0; while IFS=: read -r u p uid g c h sh; do for x in root sync shutdown halt; do [ "$u" = "$x" ] && continue 2; done; case $u in +*) continue;; esac; [ "$uid" -lt "$min" ] 2>/dev/null || continue; printf "%s\n" "$shells" | grep -qxF -- "$sh" && bad=1; done < /etc/passwd; [ $bad -eq 0 ] && echo compliant || echo noncompliant

예상 출력

compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Run the commands appropriate for your distribution: Set the shell for any accounts returned by the audit to nologin: # usermod -s $(which nologin) <user> Lock any non root accounts returned by the audit: # usermod -L <user> The following command will set all system accounts to a non login shell: awk -F: '($1!="root" && $1!="sync" && $1!="shutdown" && $1!="halt" && $1!~/^\+/ && $3>='"$(awk '/^\s*SYS_UID_MIN/{print $2}' /etc/login.defs)"' && $3<='"$(awk '/^\s*SYS_UID_MAX/{print $2}' /etc/login.defs)"' && $7!="'"$(which nologin)"'" && $7!="/bin/false") {print $1}' /etc/passwd | while read user; do usermod -s $(which nologin) $user; done The following command will automatically lock not root system accounts: awk -F: '($1!="root" && $1!~/^\+/ && $3>='"$(awk '/^\s*SYS_UID_MIN/{print $2}' /etc/login.defs)"' && $3<='"$(awk '/^\s*SYS_UID_MAX/{print $2}' /etc/login.defs)"') {print $1}' /etc/passwd | xargs -I '{}' passwd -S '{}' | awk '($2!="L" && $2!="LK") {print $1}' | while read user; do usermod -L $user; done

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

tmaegis scan --target cos --level 2